Cycle dependency when importing resources with access_token in default Google provider

[xynova]

Filed the original issue in under google-provider but the problem seems to be in TF core as mentioned here:
hashicorp/terraform-provider-google#4443

Terraform Version

Terraform version: 0.12.8

provider.google v2.14.0
provider.google-beta v2.14.0

Terraform Configuration Files

terraform {
  required_version = ">=v0.12.8"
  required_providers {
    google = "v2.14.0"
    google-beta = "v2.14.0"
  }
}

provider "google" {
  alias = "myself"
}

data "google_service_account_access_token" "impersonated" {
  provider = "google.myself"
  target_service_account = "${var.run_plan_as_svcacc}"
  lifetime = "300s"
  scopes = [
    "https://www.googleapis.com/auth/cloud-platform"
    ]
}

provider "google" {
  access_token = "${data.google_service_account_access_token.impersonated.access_token}"
  project = "${var.project}"
  region = "${local.location}"
}

Debug Output

https://gist.github.com/xynova/4117bfe303fb04260ad6c64d87c55374

Expected Behavior

I would have expected the provider hierarchy to be resolved

Actual Behavior

Error: Cycle: data.google_service_account_access_token.impersonated, provider.google

Steps to Reproduce

terraform import google_kms_crypto_key.etcd_enc_key projects/myproject/locations/australia-southeast1/keyRings/gke-clusters-keyring/cryptoKeys/experiments-cluster-v2-cluster-etcd-key

References

hashicorp/terraform-provider-google#4443

[mildwonkey]

I think this might be a duplicate of #22564 (though not enough to close this one!) - terraform import is not playing nice with anything other than default provider configuration.

[mildwonkey]

Hi @xynova , thank you for reporting this!
I have fixed the cycle dependency in #22855, and my next PR #22862 (not yet merged at the time of writing this comment) will close this issue.

Unfortunately, you will still get an error in this example, but now at least it's consistent with our documentation. The terraform import documentation specifies that a provider used in import cannot depend on a data source (or other resource).

[mildwonkey]

Hi @xynova ! Sorry for the back and forth, but I have an update for you. After quite a bit of internal discussion, we decided not to merge my above PR before terraform 0.13 (if at all), so I hope that you will find your problem fixed with #22855.

We came to the conclusion that it is better to preserve the current behavior, despite the contradictory documented behavior, instead of breaking a working behavior that users are currently using, even if it was only accidentally working.

[xynova]

Thanks @mildwonkey, I had missed that part of the import documentation. I clearly need to then change the way I am doing service account impersonation to avoid getting into this issue.

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.